Information Systems Supply Chain Risk Management
BLINN COLLEGE ADMINISTRATIVE REGULATIONS MANUAL
SUBJECT: Information Systems Supply Chain Risk Management
EFFECTIVE DATE: July 20, 2023; amended September 19, 2023
BOARD POLICY REFERENCE: CS
PURPOSE
Develop policies and procedures for information system supply chain risk management.
PROCESS
Supply Chain Risk Management Policy and Procedures (MA-01)
The College District
- Develops, documents, and disseminates to information system owners:
- A supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Procedures to facilitate the implementation of the supply chain risk management policy and associated supply chain risk management controls; and
- Reviews and updates the current:
- Supply chain risk management policy biennially; and
- Supply chain risk management procedures annually.
Supply Chain Risk Management Plan (SR-02)
The College District
- Develops a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, and disposal of the information systems, components or system services.
- Implement the supply chain risk management plan consistently across the organization; and
- Review and update the supply chain risk management plan as required, to address threats, organizational or environmental changes.
Supply Chain Controls and Processes (SR-03)
The College District
- Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of information systems in coordination with CISO and information system owners;
- Employ the following supply chain controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: TX-RAMP; and
- Document the selected and implemented supply chain processes and controls in the TX-RAMP Questionnaire.
Acquisition Strategies, Tools and Methods (SR-05)
The College District
Employs the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: TX-RAMP,
Notification Agreements (SR-08)
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the: notification of supply chain compromises; results of assessments or audits; Using:
- Vulnerability scanning;
- Vendor notifications;
- MS-ISAC, TX-ISAO notifications; and
- Other publications
Component Disposal (SR-12)
Dispose of organization-defined data, documentation, tools, or system components using media protection or equivalent methods.